Create CSR and Importing third party certificate in Mobile Access Blade

[Gaurav_Pandya]

Hi All,

This is about Creating CSR and importing third party certificate to gateway for Mobile Access Blade. We have already SK69660 but adding snapshot for better idea.

First generate Request to generate certificate (CSR) with below command.

cpopenssl req -new -out <CERT.CSR> -keyout <KEYFILE.KEY> -config $CPDIR/conf/openssl.cnf

Then you can send this *.csr file to third party so that they can create certificate for you.

Third party will give you combined certificate where 3 certificates (Primary SSL, Intermediate & Root) will resides or separate certificates. If you receive separate certificates then you need to combine all certificates in Text Editor as suggested in sk69660. Please make combined file in *.crt format.

Now the final stage is to import certificate in Firewall but before that we need to convert this certificate ext from *.crt to *.P12 You need to use below command for conversion.

cpopenssl pkcs12 -export -out <New file name as P12> -in <Your combined certificate> -inkey <Private key which is generated during CSR>

 

Now this *.P12 file you need to import in Gateway --> Properties --> Mobile Access --> Portal Setting --> Import the file.

Save & Push policy.

Now when you connect sslvpn (https://Gateway_IP/sslvpn), you will not get any certificate error and you can see certificate that is provided by third party.

[Zaw_Hein_Aung]

I am getting a pop up to key-in password, but I didn't set any password on .p12 file. Any idea please?

[Gaurav_Pandya]

I have kept password. If you didn't set password then just keep it blank and enter, it fails then I think you can regenerate the .p12 and keep password.

[Zaw_Hein_Aung]

Thanks for the reply, I had tried that too. Received the same "password is incorrect" error regardless the certificate is with or without password.

[Gaurav_Pandya]

Hmm. Strange.

[Zaw_Hein_Aung]

I've managed to make it work with a workaround. Export the .P12 cert using openssl on windows server and import to CP gateway.

CP tech support is still checking why the cert exported from security gateway is not working.

[Gaurav_Pandya]

Ok. Please let us know whatever the result is.

[Brian_Kirwan]

I had a similar issue importing server certs for https inspection,  i  found that i needed to use the -passin and -passout options with openssl when creating the p12 or else the import always failed with incorrect password 

openssl pkcs12 -export -out  website.p12 -inkey  website.key  -in website.pem  -certfile  ca-chain.pem -passin pass:privatekeypass  -passout pass:privatekeypass 

[Alsnator_C]

Is there any procedure on how to do it on cluster firewalls?

[Di_Junior]

Hi there, I would like to know the same thing. Did you perhaps managed to get it to work in cluster environment.

[Vladimir]

I am about to do this in a clustered production environment and will try to remember to update this thread. Of note though is that when generating CSR, I had to include "-newkey rsa:2048" in the command:

"openssl req -new -newkey rsa:2048 -nodes -out gw8010.blablabla.com.rsa.csr -keyout gw8010.blablabla.com.rsa.pkey -subj "/C=US/ST=New Jersey/L=Wayne/O=Higher Intelligence LLC/CN=gw8010.blablabla.com"

Else the CA was complaining.

[Vladimir]

No problem with deployment in the clustered environment.

Just completed it today.

You perform CLI certificate operations on a single cluster member, but import resultant certificate in the SmartConsole in the Cluster Object's properties.

[Ilmo_Anttonen]

I started this process last week, creating the CSR and requested the cert. Today when I was going to finish it, I realised that I should have noted the key-file which I used to sign the CSR request. Because I need to re-use that same key now to install the certificate, right?

Question is, what to do if I lost the pw to the .key file?

[Ilmo_Anttonen]

The solution was to just create a new csr. 

Now I know I need to save the password for the inkey file.